Signs of an attack ?

Signs of the attack are perfectly visible in all the cases:

SSH

the public key has changed

HTTPS

the certificate is destined to another server

the certificate is signed by an unknown authority